CMMC Guide · Getting certified

How to Get CMMC Certified: A Step-by-Step Path

Getting CMMC status takes eight steps: confirm the level your contract requires, identify your FCI and CUI, define your scope, find your gaps, fix and document them, complete the assessment, record the result in SPRS with an affirmation, and keep it current. The steps are the same at every level; only the requirements and the assessor change.

What are the steps to get CMMC certified?

  1. Confirm the requirement

    Check your solicitations, contracts and subcontracts for the DFARS 252.204-7021 clause and note the CMMC level and assessment type required.

  2. Identify your FCI and CUI

    Find out what information you receive or create for the contract and where it lives: email, file shares, cloud services, laptops, paper.

  3. Define your scope

    List the systems, people, facilities and service providers that handle or protect that information. Keeping CUI in a smaller, separate environment can reduce cost.

  4. Find your gaps

    Compare what you do today with each requirement and its assessment objectives. A clear gap list becomes your project plan.

  5. Fix and document

    Close the gaps, write your system security plan and policies (required at Levels 2 and 3), and collect the evidence an assessor will expect.

  6. Complete the assessment

    Perform a self-assessment, or schedule an authorized C3PAO or DCMA DIBCAC assessment if your contract requires one.

  7. Record and affirm

    The result is recorded in SPRS and receives a CMMC unique identifier (CMMC UID). Your Affirming Official, a senior representative, affirms continuing compliance in SPRS.

  8. Keep it current

    Affirm every year, reassess on schedule (yearly at Level 1, every three years at Levels 2 and 3) and keep assessment evidence for six years.

Self-assessment or third-party assessment?

Your contract decides. Level 1 is always a self-assessment. Level 2 can be a self-assessment or a C3PAO certification assessment, and Level 3 is always assessed by DCMA DIBCAC.

Self-assessment

Your team scores each requirement, enters the result and scope in SPRS and affirms it. Accuracy matters: the government relies on what you report.

C3PAO assessment

You choose an authorized C3PAO from The Cyber AB Marketplace. Its assessors review your evidence and submit the result to the government.

Compare all three levels: CMMC levels compared · Rules for scoring and open items: CMMC assessments

Questions about getting CMMC certified

Do we need CMMC status before we bid?

You need a current CMMC status at the required level when the contract is awarded, and it must stay current to exercise options. Since assessments take time, start well before the bids that require it.

What is a CMMC UID?

A 10-character identifier assigned in SPRS to each CMMC assessment, for each information system assessed. You give it to the contracting officer so they can check your status before award.

How do we find an authorized C3PAO?

Authorized and accredited C3PAOs are listed in The Cyber AB Marketplace. Only they can perform Level 2 certification assessments.

Ready to start your CMMC project?

Talk to a CMMCMARK specialist about your level, your scope and a realistic plan.

Talk to a CMMC specialist Explore CMMC training

Prefer the phone? Call +1 (202) 867-8444.

Sources